Illustration for How to Use Terminal in macOS Recovery to Find and Copy Important Files

How to Use Terminal in macOS Recovery to Find and Copy Important Files

Published by
Illustration for How to Use Terminal in macOS Recovery to Find and Copy Important Files

If your Mac will not start normally, you can use Terminal in macOS Recovery to locate important files and copy them to an external drive. The safest approach is to identify the correct volumes first, mount them if necessary, and use ditto or cp to copy files without altering the originals.

Quick Answer

  1. Start your Mac in macOS Recovery. 2. Open Utilities > Terminal. 3. Use diskutil list to identify the internal and external drives. 4. Mount the needed volumes with diskutil mount. 5. Use ls and find to locate files. 6. Copy them to an external drive with ditto. 7.

Before You Begin

You will need:

  • Your Mac
  • An external drive with enough free space
  • A way to connect the drive to the Mac, such as USB-C, USB-A, or an adapter
  • The password for an administrator account, if the startup disk is encrypted
  • Enough time to copy the files

The external drive should use a format that macOS can write to, such as APFS, Mac OS Extended (Journaled), or exFAT. A drive formatted as NTFS may be readable but not writable by macOS without additional software.

If the external drive contains files you need, do not erase or reformat it. Recovery may display prompts asking to initialize or erase an unfamiliar disk. Cancel those prompts unless you are certain which disk you are working with.

If macOS Recovery itself will not load, use How to Fix macOS Recovery Not Loading before continuing.

Start macOS Recovery and Open Terminal

The startup process differs between Macs with Apple silicon and Intel-based Macs.

On a Mac with Apple silicon

  1. Shut down the Mac completely.
  2. Press and hold the power button.
  3. Release the button when Loading startup options appears.
  4. Select Options, then click Continue.
  5. Choose an administrator account if prompted.
  6. Enter the account password.
  7. In the Recovery app, choose Utilities > Terminal from the menu bar.

On an Intel-based Mac

  1. Shut down the Mac.
  2. Turn it on and immediately press and hold Command-R.
  3. Release the keys when you see the Apple logo or a spinning globe.
  4. Select an administrator account if prompted, then enter its password.
  5. Choose Utilities > Terminal from the menu bar.

If you are unsure which type of Mac you have, try the Apple silicon method first only if the Mac has a power button that you normally hold to turn it on. Otherwise, use the Intel method.

Identify the Disks and Volumes

In Terminal, enter:

diskutil list

This command does not change your files. It displays the disks and volumes connected to the Mac.

You may see entries similar to these:

/dev/disk0 (internal, physical):
   0: GUID_partition_scheme
   1: EFI EFI
   2: Apple_APFS Container disk3

/dev/disk3 (synthesized):
   1: APFS Volume Macintosh HD
   2: APFS Volume Macintosh HD - Data

/dev/disk4 (external, physical):
   0: GUID_partition_scheme
   1: ExFAT BackupDrive

The exact names and identifiers will vary. On many modern Macs, the system volume is named Macintosh HD, while personal files are stored on Macintosh HD – Data. Do not assume these names are correct for your Mac; confirm them in the diskutil list output.

Look for:

  • Internal versus external
  • The volume name
  • The file system, such as APFS or ExFAT
  • The identifier, such as disk3s1 or disk4s1

The identifier is important because it tells diskutil which volume to mount. Never use an identifier copied from an example if it does not match your screen.

Mount the Volumes You Need

Recovery may not automatically mount every volume. To mount a specific volume, use its identifier:

diskutil mount disk3s1

Replace disk3s1 with the identifier for the volume you need.

If the volume is already mounted, Terminal may report that it is already mounted. That is not an error. To mount every mountable volume on a disk, you can use:

diskutil mountDisk disk3

Replace disk3 with the correct disk identifier.

After mounting, list the mounted volumes:

ls /Volumes

You may see output such as:

Macintosh HD
Macintosh HD - Data
BackupDrive

The names under /Volumes are the paths Terminal uses to access the drives. A space in a volume name must be escaped with a backslash or enclosed in quotation marks. For example:

ls "/Volumes/Macintosh HD - Data"

or:

ls /Volumes/Macintosh\ HD\ -\ Data

Using quotation marks is usually easier and reduces typing mistakes.

Unlock an Encrypted Startup Volume

If FileVault is enabled, the volume containing your personal files may be locked. In that case, diskutil list can show the volume, but you may not be able to browse its contents.

First, try mounting the volume:

diskutil mount disk3s1

If macOS asks for a password, enter the password for an account authorized to unlock the disk. On some Macs, Recovery may also accept a FileVault recovery key.

You can inspect APFS volumes with:

diskutil apfs list

This command displays APFS containers, volumes, encryption status, and identifiers. It does not change the disk.

If the volume remains locked, do not repeatedly guess passwords. Confirm that you are using the password for a user authorized to unlock the startup disk, rather than a different Apple Account or email password.

Find Important Files

Once the correct data volume is mounted, use ls to inspect its folders. For example:

ls "/Volumes/Macintosh HD - Data/Users"

This should show the user folders on the data volume. Replace yourname with the name of your macOS user account:

ls "/Volumes/Macintosh HD - Data/Users/yourname"

Common folders include:

  • Desktop
  • Documents
  • Downloads
  • Pictures
  • Movies
  • Music

To view files in a specific folder:

ls -la "/Volumes/Macintosh HD - Data/Users/yourname/Documents"

The -l option displays details such as file size and modification date. The -a option includes hidden files.

Search by file name

The find command can search a folder and its subfolders. For example, to search for PDF files in Documents:

find "/Volumes/Macintosh HD - Data/Users/yourname/Documents" -type f -iname "*.pdf"

This command only searches; it does not modify files.

You can search for common document types:

find "/Volumes/Macintosh HD - Data/Users/yourname" \
  -type f \( -iname "*.doc" -o -iname "*.docx" -o -iname "*.pages" -o -iname "*.xlsx" \)

To search for a particular name:

find "/Volumes/Macintosh HD - Data/Users/yourname" \
  -type f -iname "*tax*"

The asterisks mean that the file name can contain other characters before or after the word. Searches may produce permission messages or take time on a large disk.

Use a graphical view when available

Terminal is useful when Finder is unavailable, but you can also open Disk Utility in Recovery to inspect and mount volumes. In some Recovery environments, choosing File > New Finder Window is available, although Finder access is not consistent across all Recovery configurations.

If you use Finder, avoid dragging system folders or changing permissions. Focus on copying personal files from your user folder.

Copy Files to an External Drive

Before copying, confirm that the external drive is mounted:

ls /Volumes

Assume the source folder is:

/Volumes/Macintosh HD - Data/Users/yourname/Documents

and the external drive is named:

/Volumes/BackupDrive

Create a destination folder on the external drive:

mkdir -p "/Volumes/BackupDrive/Recovery Backup/Documents"

The mkdir -p command creates the destination folder if it does not exist. It does not delete existing files, but make sure the path is correct before continuing.

Copy the entire Documents folder with ditto:

ditto "/Volumes/Macintosh HD - Data/Users/yourname/Documents" \
  "/Volumes/BackupDrive/Recovery Backup/Documents"

ditto copies folders and their contents while generally preserving useful file information. If a folder already exists at the destination, check the destination carefully: copying into an existing folder can add or replace files with matching names.

You can copy individual files in the same way:

ditto "/Volumes/Macintosh HD - Data/Users/yourname/Desktop/Important.pdf" \
  "/Volumes/BackupDrive/Recovery Backup/Important.pdf"

To copy several common personal folders, run separate commands:

ditto "/Volumes/Macintosh HD - Data/Users/yourname/Documents" \
  "/Volumes/BackupDrive/Recovery Backup/Documents"

ditto "/Volumes/Macintosh HD - Data/Users/yourname/Desktop" \
  "/Volumes/BackupDrive/Recovery Backup/Desktop"

ditto "/Volumes/Macintosh HD - Data/Users/yourname/Pictures" \
  "/Volumes/BackupDrive/Recovery Backup/Pictures"

These commands copy data from the internal volume to the external volume. They do not erase the source files, and there is no special reversal command. If you copied the wrong files, remove them from the external drive later using Finder or Terminal—but do not use rm in Recovery unless you are completely certain of the path.

Verify the Backup

Do not assume a command succeeded simply because the prompt returned. Check that the destination exists:

ls -la "/Volumes/BackupDrive/Recovery Backup/Documents"

You can compare the total size of the source and destination folders:

du -sh "/Volumes/Macintosh HD - Data/Users/yourname/Documents"
du -sh "/Volumes/BackupDrive/Recovery Backup/Documents"

The numbers may not match exactly because of file-system differences, hidden files, or metadata, but a major difference indicates that you should investigate.

You can also search the backup for a specific file:

find "/Volumes/BackupDrive/Recovery Backup" -iname "*Important*"

For especially important files, open the external drive in another Mac after restarting, if possible. Confirm that documents open correctly and that photos or videos are not visibly damaged.

Safely Eject the External Drive

When copying is complete, flush pending writes and eject the external disk:

sync
diskutil eject disk4

Replace disk4 with the identifier for your external disk. Use diskutil list if you need to confirm it.

The sync command asks macOS to finish writing cached data. diskutil eject unmounts and ejects the disk. Wait for the confirmation before disconnecting it.

If you plan to continue troubleshooting the internal disk, keep the backup disconnected unless you need it. This reduces the risk of accidentally selecting it in Disk Utility.

Troubleshooting

The internal volume does not appear

Run:

diskutil list

If the internal physical disk is missing, shut down the Mac and check power, cables, hubs, and adapters. An internal hardware problem may require service.

If the disk appears but its volumes are not mounted, try mounting the relevant volume with diskutil mount. You can also open Disk Utility and choose View > Show All Devices to see the physical disk, containers, and volumes.

Before attempting repairs, copy data if possible. If you need to repair the startup disk afterward, see How to Repair a Mac Startup Disk in macOS Recovery.

The volume is locked

Use diskutil apfs list to check the encryption status. Mount the volume and enter the password for an authorized user when prompted. If no authorized password works, you may need the FileVault recovery key.

Do not erase the volume to make it accessible. Erasing removes its contents.

“Read-only file system” appears

The source volume may be mounted read-only, which is generally acceptable when copying files. The destination volume, however, must be writable.

Check the external drive’s format and mount status. If it is NTFS, macOS may not be able to write to it. Use another compatible drive rather than reformatting the existing one when it contains data you need.

“No such file or directory” appears

The path is incorrect, the volume is not mounted, or the volume name contains spaces that were not quoted correctly.

List mounted volumes:

ls /Volumes

Then copy the exact name into a command inside quotation marks. Also verify the user account name with:

ls "/Volumes/Macintosh HD - Data/Users"

The copy stops or reports an error

Check that the external drive has enough free space:

df -h "/Volumes/BackupDrive"

A failing disk, damaged file, disconnected cable, or incompatible destination format can interrupt a copy. Try copying smaller folders first and avoid using an unreliable hub or adapter.

Disk Utility reports a problem

Do not erase the disk simply because Disk Utility reports an error. First preserve accessible files. If the Mac repeatedly starts in Recovery, additional startup troubleshooting may be needed; see How to Fix a Mac That Starts in macOS Recovery Instead of macOS.

Frequently Asked Questions

Can I use Terminal in Recovery without logging in?

You can open Terminal in some Recovery environments without signing in, but an encrypted startup volume may remain locked. You need an authorized password or recovery key to access protected files.

Where are my personal files stored?

They are normally inside your user folder under /Users/yourname.

Can I copy files to an external USB drive?

Yes, as long as the drive is detected, mounted, and writable. Confirm it with diskutil list and ls /Volumes. Make sure it has enough free space.

Can I copy an entire home folder?

You can, but it may contain hidden files, caches, and application data that are not useful for a basic backup.

Is Terminal in Recovery the same as Terminal in macOS?

No. Recovery runs a separate minimal system. Commands, volume paths, permissions, and available services may differ from a normal macOS session.

Final Thoughts

Terminal in macOS Recovery can help you save important files when macOS will not start normally.